See this article for an introduction to the problems of attempting to match npm with principled package management:
https://dustycloud.org/blog/javascript-packaging-dystopia/